All attack reports
Lost in the Fog: A New Ransomware Threat
Arctic Wolf Labs began monitoring the deployment of a new ransomware variant called Fog in early May 2024. The ransomware attacks targeted organizations in the education and recreation sectors within the United States. Evidence suggests threat actors gained initial access through compromised VPN cr…
Downloadable IOCs 5
Malicious Campaign Analysis: JScript RAT and CobaltStrike
This report examines a recent malicious campaign involving a JScript-based Remote Access Trojan (RAT) and its connections to the CobaltStrike penetration testing tool. The attack commences with an obfuscated JScript loader distributed through suspected phishing campaigns. Upon execution, it contact…
Downloadable IOCs 4
Targets Ukraine's Defense Forces using SPECTR malware alongside legitimate SyncThing
The report describes a cyber attack campaign by the UAC-0020 (Vermin) threat group targeting Ukraine's Defense Forces. The attackers utilized the SPECTR malware in tandem with the legitimate SyncThing software to exfiltrate sensitive data. The malicious payload was delivered via a password-protecte…
Downloadable IOCs 33
Howling at the Inbox: Sticky Werewolf's Latest Malicious Aviation Attacks
Morphisec Labs has been monitoring increased activity associated with Sticky Werewolf, a suspected geopolitical or hacktivist group. While their origin remains unclear, recent techniques suggest espionage and data exfiltration intent. Sticky Werewolf has targeted the aviation industry, employing ph…
Downloadable IOCs 14
Commando Cat: A Novel Cryptojacking Attack Abusing Docker Remote API Servers
This report details a cryptojacking campaign exploiting exposed Docker remote API servers. Threat actors employ the cmd.cat/chattr Docker image for initial access, utilizing techniques like chroot and volume binding to break out of the container and access host systems. They deploy cryptocurrency m…
Downloadable IOCs 7
Malware Targets Message Queuing Services Applications
The report describes a recent campaign targeting Apache RocketMQ platforms, where attackers exploited a known vulnerability (CVE-2023-33246) to gain remote code execution on the systems. They then downloaded and executed the Muhstik malware, which provides persistence, evades detection, performs la…
Downloadable IOCs 21
Operation ControlPlug: Targeted attack campaign using MSC files
An investigation revealed that the threat group DarkPeony, also known as Operation ControlPlug, employed a novel technique involving MSC (Microsoft Common Console Document) files to initiate their malicious activities. These files, generally unfamiliar, leveraged the Console Taskpad feature to exec…
Downloadable IOCs 14
Malicious Python Script with a "Best Before" Date | Cobalt Strike Beacon
This post details analysis of a malicious Python script, which yielded a hash for a Cobalt Strike beacon.
Downloadable IOCs 1
Fake Advanced IP Scanner Installer Delivers Dangerous Backdoor
Security researchers discovered a malicious version of the Advanced IP Scanner installer, which contained a backdoored DLL module. The compromised installer was distributed through a typo-squatted domain and appeared in search results for the legitimate software. When executed, the installer inject…
Downloadable IOCs 11
TargetCompany’s Linux Variant Targets ESXi Environments
Since its discovery in 2021, TargetCompany has been evolving its techniques to circumvent security defenses employed by organizations; one such technique its use of a PowerShell script to bypass Antimalware Scan Interface (AMSI) and abuse of fully undetectable (FUD) obfuscator packers. A new varian…
Downloadable IOCs 3
DarkGate again but... Improved?
The report details the latest developments surrounding the DarkGate remote access trojan, including its enhanced capabilities in version 6, the activities of its developer RastaFarEye, and an in-depth analysis of the malware's new features, execution chain, and supported commands. It highlights Dar…
Downloadable IOCs 313
Wineloader - Analysis of the Infection Chain
The analysis examines the Wineloader backdoor, a modular malware attributed to the APT29 threat group, which allows further tools or modules to be downloaded through an encrypted command and control channel. It starts with a phishing email luring targets with a wine tasting event invitation. Execut…
Downloadable IOCs 9